dotnet / dotnet/core

Minimize vulnerabilities by offering service which offers simple notifications when new SDK/Runtimes are released

Open
#4,822 10 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
22k
Forks
4.9k
Avg merge
5d 5h
Merged PRs (30d)
29

Description

Currently, whenever a vulnerability is discovered in dotnet SDK/Runtime somewhere and a subsequent update is made and released, developers in the community are either
-Not notified immediately
-Notified by email (by subscribing/watching the announcements)

Its great that engineers can subscribe/watch the announcements to get this information, but in my opinion there is major room for improvements in order to _minimize vulnerabilities globally_.

For example: Imagine Microsoft dotnet core team offered a simple website which had a simple form: Two input parameters
"Hey developers. Want to be notified immediately when new dotnet SDK/Runtimes are released? Tired of discovering vulnerabilities in SDK's days/weeks/months after they are found? Enter your email and phone number below to get immediate notifications when we make updates."
Input: Email
Input: Phone Number (SMS enabled)

SMS has open rates that are around 90%, and makes SMS a far superior communication channel than email. However, getting notifications on both is optimal since it decreases the average time it takes the average developer to discover these updates.

For example: Lets imagine that today, the average amount of time it takes any given developer to realize a new dotnet core SDK/Runtime was released is 15 days.
AVGTimeToDiscovery = 15d

Now, if we were to implement an SMS notification to those interested in getting these updates real-time instead, its highly likely (and perhaps agreeable to many) that the AVGTimeToDiscovery for those that do subscribe to be less than 15d
AVGTimeToDiscovery (considering engineer subscribes to SMS) < 15d

Would anyone dispute that having an SMS notification would have little to no impact?

To be completely honest, this is a service that I myself could build/engineer. However, its really worth offering and socializing this type of website/service in the instance Microsoft feels its worthwhile to offer/engineer.

Please let me know how I can minimize the amount of time it takes to get notifications. 1 issue I have with subscribing/watching announcements is that if we get emails with announcements for changes other than new SDK/Releases, those emails get noisy. Here, I am assuming that my goal is the same goal as many others:
Minimize amount of time vulnerabilities exist on local development machines + app servers.
1 solution ( not the only certainly) is to allow engineers to get SMS updates only when new SDK/Runtimes are released. What is the thought on this?
Thank you in advance for reading this concept. Ultimately, I hope to improve the speed for everyone, not just myself. I dont feel that I am alone in this goal.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.